Topic starter
22/06/2026 10:07 am
TL;DR: AI agents are creating a governance gap because most identity and security tools were built for people, not digital actors that access data, execute tasks, and make decisions autonomously, according to Omada Identity. The practical issue is not visibility alone, but accountability, privilege scope, and audit evidence across AI agents and other non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Omada Agent Governance, Extends Identity Governance to AI Agents”.
Key questions
Q: What breaks when AI agents are not governed at runtime?
A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context.
Q: Why do AI agents create new risk in non-human identity management?
A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.
Q: How do security teams know if an AI agent has too much access?
A: Look for agents that can reach multiple systems without task-specific limits, use persistent tokens, or touch high-value services such as email, chat, cloud consoles, and file stores.
Practitioner guidance
- Define AI agents as governed identities Create a governance category for AI agents with explicit ownership, lifecycle status, and accountable approvers so they are not tracked as generic application components.
- Map agent ownership and accountability Require a named business and technical owner for every agent before it is allowed to access systems or data, and block orphaned agents from production use.
- Compare granted access with actual usage Review whether each agent's entitlement set matches the tasks it actually performs, then remove access that is never exercised or no longer needed.
Bottom line: AI agents create a governance gap because current identity programmes still assume the subject is a person with stable ownership and predictable access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:53 am
AI agent governance is becoming a distinct identity discipline, not a feature of existing IGA. The article is right to frame AI agents as a new class of digital actor rather than a minor extension of workload identity. Once an actor can connect, access, execute, and make decisions, ownership and entitlement management need their own lifecycle treatment. Practitioners should stop treating agent oversight as an add-on to user governance and start treating it as a governed identity class.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do before scaling AI agent access?
A: Organisations should define ownership, consent, auditability, and revocation for agents before broad deployment. If the agent can access customer accounts, the control set must be in place at design time, not after the first incident. Scaling without those controls turns experimentation into governance debt.
👉 Read our full editorial: Omada Agent Governance shows the identity gap for AI agents